This vulnerability in LambertGroup's Multimedia Responsive Carousel with Image Video Audio Support plugin allows SQL Injection due to improper neutralization of special elements in SQL commands. It affects all versions up to 2.6.0. The CVSS 3.1 score is 8.5, indicating high severity, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no indication of integrity compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access privileges to the affected plugin and monitor for updates from LambertGroup. No official patch or workaround information is currently provided.